Next.js races to patch critical RCEs as Expo SDK 58 arrives

Security first: Next.js RCE patches

The week's most urgent news came from Next.js, which patched two critical unauthenticated remote code execution vulnerabilities — one in use cache functions returning typed arrays, and one in the Image Optimization API when SVG files are used — alongside a high-severity denial of service in the App Router using Server Actions. The 16.x line got the full set of fixes, while the 15.5 line received the Image Optimization RCE and the Server Actions DoS backport, so apps pinned to the older major can close the more broadly reachable hole without a major upgrade. Anyone accepting user-supplied SVGs through next/image should treat this as a drop-everything upgrade; the advisories carry the full detail.

Next.js also kept its quieter channels moving. The LTS branch picked up Turbopack dev module graph chaining for the Pages Router plus a batch of snapshot-consistency fixes, tidying lazy dynamic-import chunk collisions and module-resolution realpath errors along the way. And on canary, Turbo-persistence began prefetching multi-page SST blocks with MADV_WILLNEED — plumbing work that hints at faster incremental builds ahead.

Expo SDK 58 lands with iOS 27 and Apple Intelligence

Expo's headline release is SDK 58, built for iOS 27 and React Native 0.88. Because iOS 27 requires the UIKit scene-based life cycle and makes iPhone apps resizable, this is a compatibility milestone as much as a feature drop. The alpha expo-app-intents package exposes app actions to Siri, Shortcuts, Spotlight, and Apple Intelligence; expo-hinge reports foldable hinge state; and expo-device-hub streams simulators into the browser. Alongside it, expo.dev settings got a redesign around dedicated pages and a consistent sidebar, with billing, access tokens, credentials, and hosting reorganized into their proper scopes.

EAS CLI: simulator control for agents

EAS CLI spent the week building out remote-simulator workflows aimed squarely at coding agents. The release train added an eas simulator:control command that runs serve-sim actions like file upload and download on a remote iOS simulator, a headline change that also defaulted new simulator sessions to authenticated preview links, with public sharing opt-in via --public-link, and started expo-device-hub for Android sessions. Agent tooling deepened with the eas/run_agent build step that runs Claude Code or Codex against the Expo MCP server — which also deprecated Node.js 20 for a future Node 22 requirement — and device run session jobs now call www only through the worker API after dropping their GraphQL fallbacks. Maestro users got a --platform flag for per-platform run and flow insights.

SvelteKit hardens CSP, Nuxt cleans up routing

SvelteKit's batch leaned toward server-side correctness: the kit added CSP report-sha256/384/512 reporting keywords and an endpoint span for tracing, with a fix for projects nested in a server directory wrongly treating every module as server-only. Its package tooling now emits component types for the installed Svelte version, and the adapters got platform fixes — Bun minor versions preserved in the Vercel runtime and Concurrent dev servers, Deno global quirks, and local tracing emulation fixed on Cloudflare. Nuxt's patch closed a useHeadSafe gap on server island head and made server route rules match case-insensitively.